Features Overview

Web Server

• HTTP/HTTPS — Full HTTP/1.1 support with optional TLS 1.3/1.2 encryption.
• Configurable binding — Bind to any host and port (default: 0.0.0.0:8080).
• Thread pool — Adaptive thread pool sized to available processors.

Virtual Hosting

• Multi-domain routing — Route different domains to different handlers (like Nginx server_name).
• Three site types — Static file serving, reverse proxy, and Node.js applications.
• Catch-all domain — Empty domain string matches any unmatched domain.

Static File Serving

• Path traversal protection — Normalizes paths and prevents directory escape attacks.
• Directory index — Automatically serves index.html for directory requests.
• Extension-less URLs — /about automatically resolves to /about.html.
• MIME types — Built-in mapping for HTML, CSS, JS, JSON, images, SVG, and text.
• CORS support — Configurable cross-origin resource sharing headers.

Reverse Proxy

• HTTP forwarding — Forwards requests to any upstream HTTP server.
• Hop-by-hop headers — Strips Host, Connection, Transfer-Encoding, and other hop-by-hop headers.
• X-Forwarded- headers* — Injects X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto.

Node.js on the JVM (GraalJS)

• No Node.js binary needed — JavaScript runs inside the JVM via GraalVM Polyglot.
• CommonJS require() — Full support for require() from node_modules/.
• npm auto-install — Plugin reads package.json and downloads dependencies from the npm registry automatically.
• Request/Response API — Write handlers in JavaScript with a simple handle(request) function.
• React SSR — Server-side rendering support via react and react-dom npm packages.
• Static fallback — Node.js sites try public/ folder first, then fall through to server.js.

SSL & ACME

• Let's Encrypt integration — Built-in ACME v2 client using acme4j.
• HTTP-01 challenge — Automatic challenge file creation in .well-known/acme-challenge/.
• DNS-01 challenge — Displays required TXT record details for DNS-based validation.
• Certificate management — Automatic key generation, order creation, and certificate storage.

API Endpoints

• /api/players — Returns comma-separated list of online player names (all platforms).
• /api/placeholder (Bukkit only) — Resolves PlaceholderAPI placeholders via HTTP GET.
• Bearer token auth — Optional authorization for the placeholder endpoint.

Rate Limiting

• Per-IP token bucket — Independent rate limits for static, placeholder, and players endpoints.
• Configurable windows — Set requests and time windows per endpoint type.
• Automatic cleanup — Periodic garbage collection of stale buckets to prevent memory leaks.

Commands

• /zyveraweb — Plugin info, config reload, npm package management.
• /zyveraweb server — Start, stop, and restart the web server.
• /zyveraweb acme — Full ACME workflow: start, ToS acceptance, confirm, apply.

Metrics

• FastStats integration — Tracks request counts, response codes, SSL certificates issued.
• Categorized counters — Website, placeholder, player, Node.js, and script requests.
• Response code tracking — Informational, success, redirection, client error, server error.

Permissions

• Granular access control — Separate permissions for info, server management, node operations, and ACME.
• Default roles — Info command available to all players; admin commands restricted to operators.